DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-61453: CVE-2026-61453: Stored Cross-Site Scripting via Twig String Concatenation Bypass in Grav CMS

#security #cve #cybersecurity

CVE-2026-61453: Stored Cross-Site Scripting via Twig String Concatenation Bypass in Grav CMS

Vulnerability ID: CVE-2026-61453
CVSS Score: 6.1
Published: 2026-09-16

Grav CMS before v2.0.1 contains a security bypass vulnerability in its blueprint validation logic. The XSS detection routine, Security::detectXss(), was executed on raw page contents prior to Twig engine processing. When Twig processing is enabled for editor-authored page content, an attacker can dynamically reconstruct harmful HTML elements, attributes, or protocols using string concatenation (e.g. {{ 'on' ~ 'error' }}). When compiled, the benign source converts into active XSS payloads, which are rendered to the client browser via raw filters. This vulnerability was resolved in version 2.0.1 by adding a post-render validation backstop.

TL;DR

A stored XSS vulnerability in Grav CMS before v2.0.1 allows attackers with page-write permissions to bypass blueprint validation filters using Twig string concatenation. The vulnerability is fixed in version 2.0.1 by introducing a post-render scanning step.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79
  • Attack Vector: Network
  • CVSS v3.1 Score: 6.1 (Medium)
  • EPSS Score: 0.00263 (Percentile: 18.26%)
  • Impact: Stored Cross-Site Scripting (XSS) / Account Takeover
  • Exploit Status: PoC (Proof of Concept) available
  • CISA KEV Status: Not Listed

Affected Systems

  • Grav CMS installations prior to version 2.0.1
  • grav: < 2.0.1 (Fixed in: 2.0.1)

Code Analysis

Commit: 6f619f0

Fix XSS blueprint validation bypass by running a post-render XSS detector on the rendered output of editor-authored Twig content.

Mitigation Strategies

  • Upgrade Grav CMS to version 2.0.1 or higher.
  • Disable Twig content processing (twig_content.process_enabled: false) if it is not required for editors.
  • Ensure the post-render XSS scanner config (twig_content.xss_scan_output: true) is enabled.

Remediation Steps:

  1. Navigate to the system root directory of the Grav installation.
  2. Execute the update process using GPM: bin/gpm selfupgrade.
  3. Verify the installation version by running bin/gpm index and confirming it is at least 2.0.1.
  4. Open the configuration file user/config/security.yaml.
  5. Add or update the following parameters under twig_content: process_enabled: false (or true if required) xss_scan_output: true.
  6. Verify that your system logs do not report security anomalies in logs/security.log.

References

Read the full report for CVE-2026-61453 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)